@aztec/node-keystore 2.1.0-rc.1 → 2.1.0-rc.3

package/dest/schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAE3D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhD,eAAO,MAAM,mBAAmB,kDAGK,CAAC;AAiEtC,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYvB,CAAC"}
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAE3D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAG/D,eAAO,MAAM,mBAAmB,kDAGK,CAAC;AACtC,eAAO,MAAM,mBAAmB,kDAGK,CAAC;AAgFtC,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYvB,CAAC"}

package/dest/schemas.js

@@ -5,6 +5,7 @@ import { AztecAddress } from '@aztec/stdlib/aztec-address';
 import { z } from 'zod';
 // Use Aztec's validation functions but return string types to match our TypeScript interfaces
 export const ethPrivateKeySchema = z.string().regex(/^0x[0-9a-fA-F]{64}$/, 'Invalid private key (must be 32 bytes with 0x prefix)').transform((s)=>s);
+export const blsPrivateKeySchema = z.string().regex(/^0x[0-9a-fA-F]{64}$/, 'Invalid BLS private key (must be 32 bytes with 0x prefix)').transform((s)=>s);
 const urlSchema = z.string().url('Invalid URL');
 // Remote signer config schema
 const remoteSignerConfigSchema = z.union([
@@ -20,7 +21,7 @@ const remoteSignerAccountSchema = z.union([
     schemas.EthAddress,
     z.object({
         address: schemas.EthAddress,
-        remoteSignerUrl: optional(urlSchema),
+        remoteSignerUrl: urlSchema,
         certPath: optional(z.string()),
         certPass: optional(z.string())
     })
@@ -50,6 +51,25 @@ const ethAccountsSchema = z.union([
     z.array(ethAccountSchema),
     mnemonicConfigSchema
 ]);
+// BLSAccount schema
+const blsAccountSchema = z.union([
+    blsPrivateKeySchema,
+    jsonKeyFileV3Schema
+]);
+// AttesterAccount schema: either EthAccount or { eth: EthAccount, bls?: BLSAccount }
+const attesterAccountSchema = z.union([
+    ethAccountSchema,
+    z.object({
+        eth: ethAccountSchema,
+        bls: optional(blsAccountSchema)
+    })
+]);
+// AttesterAccounts schema: AttesterAccount | AttesterAccount[] | MnemonicConfig
+const attesterAccountsSchema = z.union([
+    attesterAccountSchema,
+    z.array(attesterAccountSchema),
+    mnemonicConfigSchema
+]);
 // Prover keystore schema
 const proverKeyStoreSchema = z.union([
     ethAccountSchema,
@@ -60,7 +80,7 @@ const proverKeyStoreSchema = z.union([
 ]);
 // Validator keystore schema
 const validatorKeyStoreSchema = z.object({
-    attester: ethAccountsSchema,
+    attester: attesterAccountsSchema,
     coinbase: optional(schemas.EthAddress),
     publisher: optional(ethAccountsSchema),
     feeRecipient: AztecAddress.schema,

package/dest/types.d.ts

@@ -12,12 +12,14 @@ export type Hex<TByteLength extends number> = `0x${string}` & {
     readonly _length: TByteLength;
 };
 /** A json keystore config points to a local file with the encrypted private key, and may require a password for decrypting it */
-export type EthJsonKeyFileV3Config = {
+export type JsonKeyFileV3Config = {
     path: string;
     password?: string;
 };
 /** A private key is a 32-byte 0x-prefixed hex */
 export type EthPrivateKey = Hex<32>;
+/** A BLS private key is a 32-byte 0x-prefixed hex */
+export type BLSPrivateKey = Hex<32>;
 /** URL type for remote signers */
 export type Url = string;
 /**
@@ -34,14 +36,14 @@ export type EthRemoteSignerConfig = Url | {
  */
 export type EthRemoteSignerAccount = EthAddress | {
     address: EthAddress;
-    remoteSignerUrl?: Url;
+    remoteSignerUrl: Url;
     certPath?: string;
     certPass?: string;
 };
 /** An L1 account is a private key, a remote signer configuration, or a standard json key store file */
-export type EthAccount = EthPrivateKey | EthRemoteSignerAccount | EthJsonKeyFileV3Config;
+export type EthAccount = EthPrivateKey | EthRemoteSignerAccount | JsonKeyFileV3Config;
 /** A mnemonic can be used to define a set of accounts */
-export type EthMnemonicConfig = {
+export type MnemonicConfig = {
     mnemonic: string;
     addressIndex?: number;
     accountIndex?: number;
@@ -49,7 +51,7 @@ export type EthMnemonicConfig = {
     accountCount?: number;
 };
 /** One or more L1 accounts */
-export type EthAccounts = EthAccount | EthAccount[] | EthMnemonicConfig;
+export type EthAccounts = EthAccount | EthAccount[] | MnemonicConfig;
 export type ProverKeyStoreWithId = {
     /** Address that identifies the prover. This address will receive the rewards. */
     id: EthAddress;
@@ -57,12 +59,21 @@ export type ProverKeyStoreWithId = {
     publisher: EthAccounts;
 };
 export type ProverKeyStore = ProverKeyStoreWithId | EthAccount;
+/** A BLS account is either a private key, or a standard json key store file */
+export type BLSAccount = BLSPrivateKey | JsonKeyFileV3Config;
+/** An AttesterAccount is a combined EthAccount and optional BLSAccount */
+export type AttesterAccount = {
+    eth: EthAccount;
+    bls?: BLSAccount;
+} | EthAccount;
+/** One or more attester accounts combining ETH and BLS keys */
+export type AttesterAccounts = AttesterAccount | AttesterAccount[] | MnemonicConfig;
 export type ValidatorKeyStore = {
     /**
      * One or more validator attester keys to handle in this configuration block.
      * An attester address may only appear once across all configuration blocks across all keystore files.
      */
-    attester: EthAccounts;
+    attester: AttesterAccounts;
     /**
      * Coinbase address to use when proposing an L2 block as any of the validators in this configuration block.
      * Falls back to the attester address if not set.

package/dest/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEhE,8DAA8D;AAC9D,MAAM,MAAM,GAAG,CAAC,WAAW,SAAS,MAAM,IAAI,KAAK,MAAM,EAAE,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAEhG,iIAAiI;AACjI,MAAM,MAAM,sBAAsB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzE,iDAAiD;AACjD,MAAM,MAAM,aAAa,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;AAEpC,kCAAkC;AAClC,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC;AAEzB;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAC7B,GAAG,GACH;IACE,eAAe,EAAE,GAAG,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAC9B,UAAU,GACV;IACE,OAAO,EAAE,UAAU,CAAC;IACpB,eAAe,CAAC,EAAE,GAAG,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEN,uGAAuG;AACvG,MAAM,MAAM,UAAU,GAAG,aAAa,GAAG,sBAAsB,GAAG,sBAAsB,CAAC;AAEzF,yDAAyD;AACzD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,8BAA8B;AAC9B,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,UAAU,EAAE,GAAG,iBAAiB,CAAC;AAExE,MAAM,MAAM,oBAAoB,GAAG;IACjC,iFAAiF;IACjF,EAAE,EAAE,UAAU,CAAC;IACf,sDAAsD;IACtD,SAAS,EAAE,WAAW,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,oBAAoB,GAAG,UAAU,CAAC;AAE/D,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,QAAQ,EAAE,WAAW,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB;;;OAGG;IACH,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB;;OAEG;IACH,YAAY,EAAE,YAAY,CAAC;IAC3B;;OAEG;IACH,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC;;OAEG;IACH,cAAc,CAAC,EAAE,UAAU,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACrB,0DAA0D;IAC1D,aAAa,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACjC,8GAA8G;IAC9G,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC,sEAAsE;IACtE,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,wHAAwH;IACxH,cAAc,CAAC,EAAE,UAAU,CAAC;CAC7B,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEhE,8DAA8D;AAC9D,MAAM,MAAM,GAAG,CAAC,WAAW,SAAS,MAAM,IAAI,KAAK,MAAM,EAAE,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAEhG,iIAAiI;AACjI,MAAM,MAAM,mBAAmB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtE,iDAAiD;AACjD,MAAM,MAAM,aAAa,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;AAEpC,qDAAqD;AACrD,MAAM,MAAM,aAAa,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;AAEpC,kCAAkC;AAClC,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC;AAEzB;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAC7B,GAAG,GACH;IACE,eAAe,EAAE,GAAG,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAC9B,UAAU,GACV;IACE,OAAO,EAAE,UAAU,CAAC;IACpB,eAAe,EAAE,GAAG,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEN,uGAAuG;AACvG,MAAM,MAAM,UAAU,GAAG,aAAa,GAAG,sBAAsB,GAAG,mBAAmB,CAAC;AAEtF,yDAAyD;AACzD,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,8BAA8B;AAC9B,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,UAAU,EAAE,GAAG,cAAc,CAAC;AAErE,MAAM,MAAM,oBAAoB,GAAG;IACjC,iFAAiF;IACjF,EAAE,EAAE,UAAU,CAAC;IACf,sDAAsD;IACtD,SAAS,EAAE,WAAW,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,oBAAoB,GAAG,UAAU,CAAC;AAE/D,+EAA+E;AAC/E,MAAM,MAAM,UAAU,GAAG,aAAa,GAAG,mBAAmB,CAAC;AAE7D,0EAA0E;AAC1E,MAAM,MAAM,eAAe,GAAG;IAAE,GAAG,EAAE,UAAU,CAAC;IAAC,GAAG,CAAC,EAAE,UAAU,CAAA;CAAE,GAAG,UAAU,CAAC;AAEjF,+DAA+D;AAC/D,MAAM,MAAM,gBAAgB,GAAG,eAAe,GAAG,eAAe,EAAE,GAAG,cAAc,CAAC;AAEpF,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,QAAQ,EAAE,gBAAgB,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB;;;OAGG;IACH,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB;;OAEG;IACH,YAAY,EAAE,YAAY,CAAC;IAC3B;;OAEG;IACH,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC;;OAEG;IACH,cAAc,CAAC,EAAE,UAAU,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACrB,0DAA0D;IAC1D,aAAa,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACjC,8GAA8G;IAC9G,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC,sEAAsE;IACtE,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,wHAAwH;IACxH,cAAc,CAAC,EAAE,UAAU,CAAC;CAC7B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aztec/node-keystore",
-  "version": "2.1.0-rc.1",
+  "version": "2.1.0-rc.3",
   "type": "module",
   "exports": {
     ".": "./dest/index.js",
@@ -62,9 +62,9 @@
     ]
   },
   "dependencies": {
-    "@aztec/ethereum": "2.1.0-rc.1",
-    "@aztec/foundation": "2.1.0-rc.1",
-    "@aztec/stdlib": "2.1.0-rc.1",
+    "@aztec/ethereum": "2.1.0-rc.3",
+    "@aztec/foundation": "2.1.0-rc.3",
+    "@aztec/stdlib": "2.1.0-rc.3",
     "@ethersproject/wallet": "^5.7.0",
     "tslib": "^2.4.0",
     "viem": "2.23.7",

package/src/keystore_manager.ts

@@ -18,13 +18,14 @@ import { mnemonicToAccount } from 'viem/accounts';
 import { ethPrivateKeySchema } from './schemas.js';
 import { LocalSigner, RemoteSigner } from './signer.js';
 import type {
+  AttesterAccounts,
   EthAccount,
   EthAccounts,
-  EthJsonKeyFileV3Config,
-  EthMnemonicConfig,
   EthRemoteSignerAccount,
   EthRemoteSignerConfig,
+  JsonKeyFileV3Config,
   KeyStore,
+  MnemonicConfig,
   ProverKeyStore,
   ValidatorKeyStore as ValidatorKeystoreConfig,
 } from './types.js';
@@ -110,7 +111,7 @@ export class KeystoreManager {
       const validator = this.getValidator(i);
       const remoteSigner = validator.remoteSigner || this.keystore.remoteSigner;
 
-      collectRemoteSigners(validator.attester, remoteSigner);
+      collectRemoteSigners(this.extractEthAccountsFromAttester(validator.attester), remoteSigner);
       if (validator.publisher) {
         collectRemoteSigners(validator.publisher, remoteSigner);
       }
@@ -162,38 +163,38 @@ export class KeystoreManager {
    * Best-effort address extraction that avoids decryption/derivation (no JSON-V3 or mnemonic processing).
    * This is used at construction time to check for obvious duplicates without throwing for invalid inputs.
    */
-  private extractAddressesWithoutSensitiveOperations(accounts: EthAccounts): EthAddress[] {
+  private extractAddressesWithoutSensitiveOperations(accounts: AttesterAccounts): EthAddress[] {
+    const ethAccounts = this.extractEthAccountsFromAttester(accounts);
+    return this.extractAddressesFromEthAccountsNonSensitive(ethAccounts);
+  }
+
+  /**
+   * Extract addresses from EthAccounts without sensitive operations (no decryption/derivation).
+   */
+  private extractAddressesFromEthAccountsNonSensitive(accounts: EthAccounts): EthAddress[] {
     const results: EthAddress[] = [];
 
     const handleAccount = (account: EthAccount): void => {
-      // String cases: private key or address or remote signer address
       if (typeof account === 'string') {
         if (account.startsWith('0x') && account.length === 66) {
-          // Private key -> derive address locally without external deps
           try {
             const signer = new LocalSigner(Buffer32.fromString(ethPrivateKeySchema.parse(account)));
             results.push(signer.address);
           } catch {
-            // Ignore invalid private key at construction time
+            // ignore invalid private key at construction time
           }
-          return;
         }
-
-        // Any other string cannot be confidently resolved here
         return;
       }
 
-      // JSON V3 keystore: skip (requires decryption)
       if ('path' in account) {
         return;
       }
 
-      // Mnemonic: skip (requires derivation and may throw on invalid mnemonics)
       if ('mnemonic' in (account as any)) {
         return;
       }
 
-      // Remote signer account. If it contains 'address' then extract, otherwise it IS the address
       const remoteSigner: EthRemoteSignerAccount = account;
       if ('address' in remoteSigner) {
         results.push(remoteSigner.address);
@@ -204,12 +205,15 @@ export class KeystoreManager {
 
     if (Array.isArray(accounts)) {
       for (const account of accounts) {
-        const subResults = this.extractAddressesWithoutSensitiveOperations(account);
-        results.push(...subResults);
+        handleAccount(account as EthAccount);
       }
       return results;
     }
 
+    if (typeof accounts === 'object' && accounts !== null && 'mnemonic' in (accounts as any)) {
+      return results;
+    }
+
     handleAccount(accounts as EthAccount);
     return results;
   }
@@ -219,7 +223,8 @@ export class KeystoreManager {
    */
   createAttesterSigners(validatorIndex: number): EthSigner[] {
     const validator = this.getValidator(validatorIndex);
-    return this.createSignersFromEthAccounts(validator.attester, validator.remoteSigner || this.keystore.remoteSigner);
+    const ethAccounts = this.extractEthAccountsFromAttester(validator.attester);
+    return this.createSignersFromEthAccounts(ethAccounts, validator.remoteSigner || this.keystore.remoteSigner);
   }
 
   /**
@@ -286,7 +291,6 @@ export class KeystoreManager {
     if ('id' in this.keystore.prover) {
       const id = this.keystore.prover.id;
       const signers = this.createSignersFromEthAccounts(this.keystore.prover.publisher, this.keystore.remoteSigner);
-
       return { id, signers };
     }
 
@@ -316,22 +320,17 @@ export class KeystoreManager {
   }
 
   /**
-   * Get coinbase address for validator (falls back to first attester address)
+   * Get coinbase address for validator (falls back to the specific attester address)
    */
-  getCoinbaseAddress(validatorIndex: number): EthAddress {
+  getCoinbaseAddress(validatorIndex: number, attesterAddress: EthAddress): EthAddress {
     const validator = this.getValidator(validatorIndex);
 
     if (validator.coinbase) {
       return validator.coinbase;
     }
 
-    // Fall back to first attester address
-    const attesterSigners = this.createAttesterSigners(validatorIndex);
-    if (attesterSigners.length === 0) {
-      throw new KeystoreError(`No attester signers found for validator ${validatorIndex}`);
-    }
-
-    return attesterSigners[0].address;
+    // Fall back to the specific attester address
+    return attesterAddress;
   }
 
   /**
@@ -368,7 +367,7 @@ export class KeystoreManager {
     for (let validatorIndex = 0; validatorIndex < validatorCount; validatorIndex++) {
       const validator = this.getValidator(validatorIndex);
       const signers = this.createSignersFromEthAccounts(
-        validator.attester,
+        this.extractEthAccountsFromAttester(validator.attester),
         validator.remoteSigner || this.keystore.remoteSigner,
       );
       for (const signer of signers) {
@@ -466,7 +465,7 @@ export class KeystoreManager {
   /**
    * Create signer from JSON V3 keystore file or directory
    */
-  private createSignerFromJsonV3(config: EthJsonKeyFileV3Config): EthSigner[] {
+  private createSignerFromJsonV3(config: JsonKeyFileV3Config): EthSigner[] {
     try {
       const stats = statSync(config.path);
 
@@ -546,7 +545,7 @@ export class KeystoreManager {
   /**
    * Create signers from mnemonic configuration using BIP44 derivation
    */
-  private createSignersFromMnemonic(config: EthMnemonicConfig): EthSigner[] {
+  private createSignersFromMnemonic(config: MnemonicConfig): EthSigner[] {
     const { mnemonic, addressIndex = 0, accountIndex = 0, addressCount = 1, accountCount = 1 } = config;
     const signers: EthSigner[] = [];
 
@@ -677,38 +676,56 @@ export class KeystoreManager {
       return validator.remoteSigner || this.keystore.remoteSigner;
     };
 
-    // Check the attester configuration
-    const { attester } = validator;
+    // Normalize attester to EthAccounts and search
+    const normalized = this.extractEthAccountsFromAttester(validator.attester);
+
+    const findInEthAccounts = (accs: EthAccounts): EthRemoteSignerConfig | undefined => {
+      if (typeof accs === 'string') {
+        return checkAccount(accs);
+      }
+      if (Array.isArray(accs)) {
+        for (const a of accs as EthAccount[]) {
+          const res = checkAccount(a);
+          if (res !== undefined) {
+            return res;
+          }
+        }
+        return undefined;
+      }
+      if (typeof accs === 'object' && accs !== null && 'mnemonic' in accs) {
+        // mnemonic-derived keys are local signers; no remote signer config
+        return undefined;
+      }
+      return checkAccount(accs as EthAccount);
+    };
+
+    return findInEthAccounts(normalized);
+  }
 
+  /** Extract ETH accounts from AttesterAccounts */
+  private extractEthAccountsFromAttester(attester: AttesterAccounts): EthAccounts {
     if (typeof attester === 'string') {
-      const result = checkAccount(attester);
-      return result === undefined ? undefined : result;
+      return attester;
     }
-
     if (Array.isArray(attester)) {
-      for (const account of attester) {
-        const result = checkAccount(account);
-        if (result !== undefined) {
-          return result;
+      const out: EthAccount[] = [];
+      for (const item of attester) {
+        if (typeof item === 'string') {
+          out.push(item);
+        } else if ('eth' in (item as any)) {
+          out.push((item as any).eth as EthAccount);
+        } else if (!('mnemonic' in (item as any))) {
+          out.push(item as EthAccount);
         }
       }
-      return undefined;
+      return out;
     }
-
-    // Mnemonic configuration
-    if ('mnemonic' in attester) {
-      try {
-        const signers = this.createSignersFromMnemonic(attester);
-        const matches = signers.some(s => s.address.equals(attesterAddress));
-        // Mnemonic-derived keys are local signers
-        return matches ? undefined : undefined;
-      } catch {
-        return undefined;
-      }
+    if ('mnemonic' in (attester as any)) {
+      return attester as any;
     }
-
-    // Single account object
-    const result = checkAccount(attester);
-    return result === undefined ? undefined : result;
+    if ('eth' in (attester as any)) {
+      return (attester as any).eth as EthAccount;
+    }
+    return attester as any;
   }
 }

package/src/loader.ts

@@ -285,17 +285,37 @@ export function mergeKeystores(keystores: KeyStore[]): KeyStore {
  * @returns Array of string keys used to detect duplicates.
  */
 function extractAttesterKeys(attester: unknown): string[] {
+  // String forms (private key or other) - return as-is for coarse uniqueness
   if (typeof attester === 'string') {
     return [attester];
   }
 
+  // Arrays of attester items
   if (Array.isArray(attester)) {
-    return attester.map(a => (typeof a === 'string' ? a : JSON.stringify(a)));
+    const keys: string[] = [];
+    for (const item of attester) {
+      keys.push(...extractAttesterKeys(item));
+    }
+    return keys;
   }
 
-  if (attester && typeof attester === 'object' && 'address' in attester) {
-    return [(attester as { address: string }).address];
+  if (attester && typeof attester === 'object') {
+    const obj = attester as Record<string, unknown>;
+
+    // New shape: { eth: EthAccount, bls?: BLSAccount }
+    if ('eth' in obj) {
+      return extractAttesterKeys(obj.eth);
+    }
+
+    // Remote signer account object shape: { address, remoteSignerUrl?, ... }
+    if ('address' in obj) {
+      return [String((obj as any).address)];
+    }
+
+    // Mnemonic or other object shapes: stringify
+    return [JSON.stringify(attester)];
   }
 
+  // Fallback stringify for anything else (null/undefined)
   return [JSON.stringify(attester)];
 }

package/src/schemas.ts

@@ -6,13 +6,17 @@ import { AztecAddress } from '@aztec/stdlib/aztec-address';
 
 import { z } from 'zod';
 
-import type { EthPrivateKey } from './types.js';
+import type { BLSPrivateKey, EthPrivateKey } from './types.js';
 
 // Use Aztec's validation functions but return string types to match our TypeScript interfaces
 export const ethPrivateKeySchema = z
   .string()
   .regex(/^0x[0-9a-fA-F]{64}$/, 'Invalid private key (must be 32 bytes with 0x prefix)')
   .transform(s => s as EthPrivateKey);
+export const blsPrivateKeySchema = z
+  .string()
+  .regex(/^0x[0-9a-fA-F]{64}$/, 'Invalid BLS private key (must be 32 bytes with 0x prefix)')
+  .transform(s => s as BLSPrivateKey);
 const urlSchema = z.string().url('Invalid URL');
 
 // Remote signer config schema
@@ -30,7 +34,7 @@ const remoteSignerAccountSchema = z.union([
   schemas.EthAddress,
   z.object({
     address: schemas.EthAddress,
-    remoteSignerUrl: optional(urlSchema),
+    remoteSignerUrl: urlSchema,
     certPath: optional(z.string()),
     certPass: optional(z.string()),
   }),
@@ -57,6 +61,21 @@ const ethAccountSchema = z.union([ethPrivateKeySchema, remoteSignerAccountSchema
 // EthAccounts schema
 const ethAccountsSchema = z.union([ethAccountSchema, z.array(ethAccountSchema), mnemonicConfigSchema]);
 
+// BLSAccount schema
+const blsAccountSchema = z.union([blsPrivateKeySchema, jsonKeyFileV3Schema]);
+
+// AttesterAccount schema: either EthAccount or { eth: EthAccount, bls?: BLSAccount }
+const attesterAccountSchema = z.union([
+  ethAccountSchema,
+  z.object({
+    eth: ethAccountSchema,
+    bls: optional(blsAccountSchema),
+  }),
+]);
+
+// AttesterAccounts schema: AttesterAccount | AttesterAccount[] | MnemonicConfig
+const attesterAccountsSchema = z.union([attesterAccountSchema, z.array(attesterAccountSchema), mnemonicConfigSchema]);
+
 // Prover keystore schema
 const proverKeyStoreSchema = z.union([
   ethAccountSchema,
@@ -68,7 +87,7 @@ const proverKeyStoreSchema = z.union([
 
 // Validator keystore schema
 const validatorKeyStoreSchema = z.object({
-  attester: ethAccountsSchema,
+  attester: attesterAccountsSchema,
   coinbase: optional(schemas.EthAddress),
   publisher: optional(ethAccountsSchema),
   feeRecipient: AztecAddress.schema,

package/src/types.ts

@@ -12,11 +12,14 @@ import type { AztecAddress } from '@aztec/stdlib/aztec-address';
 export type Hex<TByteLength extends number> = `0x${string}` & { readonly _length: TByteLength };
 
 /** A json keystore config points to a local file with the encrypted private key, and may require a password for decrypting it */
-export type EthJsonKeyFileV3Config = { path: string; password?: string };
+export type JsonKeyFileV3Config = { path: string; password?: string };
 
 /** A private key is a 32-byte 0x-prefixed hex */
 export type EthPrivateKey = Hex<32>;
 
+/** A BLS private key is a 32-byte 0x-prefixed hex */
+export type BLSPrivateKey = Hex<32>;
+
 /** URL type for remote signers */
 export type Url = string;
 
@@ -39,16 +42,16 @@ export type EthRemoteSignerAccount =
   | EthAddress
   | {
       address: EthAddress;
-      remoteSignerUrl?: Url;
+      remoteSignerUrl: Url;
       certPath?: string;
       certPass?: string;
     };
 
 /** An L1 account is a private key, a remote signer configuration, or a standard json key store file */
-export type EthAccount = EthPrivateKey | EthRemoteSignerAccount | EthJsonKeyFileV3Config;
+export type EthAccount = EthPrivateKey | EthRemoteSignerAccount | JsonKeyFileV3Config;
 
 /** A mnemonic can be used to define a set of accounts */
-export type EthMnemonicConfig = {
+export type MnemonicConfig = {
   mnemonic: string;
   addressIndex?: number;
   accountIndex?: number;
@@ -57,7 +60,7 @@ export type EthMnemonicConfig = {
 };
 
 /** One or more L1 accounts */
-export type EthAccounts = EthAccount | EthAccount[] | EthMnemonicConfig;
+export type EthAccounts = EthAccount | EthAccount[] | MnemonicConfig;
 
 export type ProverKeyStoreWithId = {
   /** Address that identifies the prover. This address will receive the rewards. */
@@ -68,12 +71,21 @@ export type ProverKeyStoreWithId = {
 
 export type ProverKeyStore = ProverKeyStoreWithId | EthAccount;
 
+/** A BLS account is either a private key, or a standard json key store file */
+export type BLSAccount = BLSPrivateKey | JsonKeyFileV3Config;
+
+/** An AttesterAccount is a combined EthAccount and optional BLSAccount */
+export type AttesterAccount = { eth: EthAccount; bls?: BLSAccount } | EthAccount;
+
+/** One or more attester accounts combining ETH and BLS keys */
+export type AttesterAccounts = AttesterAccount | AttesterAccount[] | MnemonicConfig;
+
 export type ValidatorKeyStore = {
   /**
    * One or more validator attester keys to handle in this configuration block.
    * An attester address may only appear once across all configuration blocks across all keystore files.
    */
-  attester: EthAccounts;
+  attester: AttesterAccounts;
   /**
    * Coinbase address to use when proposing an L2 block as any of the validators in this configuration block.
    * Falls back to the attester address if not set.